#ifndef __CAPABILITY_H__
#define __CAPABILITY_H__
#include <sys/capability.h>

/// default capabilities a container has
cap_value_t cap_list[] = {
    CAP_CHOWN,       CAP_DAC_OVERRIDE, CAP_FOWNER,
    CAP_FSETID,      CAP_KILL,         CAP_SETGID,
    CAP_SETUID,      CAP_SETPCAP,      CAP_NET_BIND_SERVICE,
    CAP_NET_RAW,     CAP_SYS_CHROOT,   CAP_MKNOD,
    CAP_AUDIT_WRITE, CAP_SETFCAP};

/// default capabilities a container should not have
cap_value_t drop_cap_list[] = {
    CAP_DAC_READ_SEARCH, CAP_NET_ADMIN,     CAP_LINUX_IMMUTABLE,
    CAP_IPC_LOCK,        CAP_IPC_OWNER,     CAP_NET_BROADCAST,
    CAP_SYS_MODULE,      CAP_SYS_RAWIO,     CAP_SYS_PTRACE,
    CAP_SYS_PACCT,       CAP_SYS_ADMIN,     CAP_SYS_BOOT,
    CAP_SYS_NICE,        CAP_SYS_RESOURCE,  CAP_SYS_TIME,
    CAP_SYS_TTY_CONFIG,  CAP_LEASE,         CAP_AUDIT_CONTROL,
    CAP_MAC_OVERRIDE,    CAP_MAC_ADMIN,     CAP_SYSLOG,
    CAP_WAKE_ALARM,      CAP_BLOCK_SUSPEND, CAP_AUDIT_READ,
    CAP_PERFMON,         CAP_BPF,           CAP_CHECKPOINT_RESTORE};

int set_full_cap();
/**
 * @brief: to accquire and drop default capabilities for current process
 **/
int default_cap();
/// warn: these APIs are not implemented yet
int add_cap(cap_t cap);
int del_cap(cap_t cap);

#endif // !__CAPABILITY_H__
